TryHackMe — After Hours: Finding a Backdoor Hidden in Plain Sight 🐚🌴

Hacker Holidays 2026 — Day 12

Sometimes the most interesting attacks don’t involve noisy exploits or obvious malware. An attacker can quietly modify a system, hide their activity inside legitimate-looking configuration, and leave behind just enough evidence for a forensic investigator to reconstruct what happened.

In this TryHackMe room, After Hours, the challenge is to investigate suspicious activity happening outside the expected operating window and uncover a hidden backdoor.

🏝️ The Scenario

The bar is closed.

Guests are asleep.

But something on the network has unexpectedly started working after hours.

Our objective is to investigate the compromised environment and determine what happened.

The room is categorized under Forensics, so instead of simply exploiting a service, we’re looking for artifacts that reveal the attacker’s actions.

🔎 Step 1 — Start With Enumeration

As with most TryHackMe investigations, the first step is understanding what is exposed on the target.

The target machine was:

10.48.95.248